elastic / elastic/logstash

Can't find sincedb or successfully start Logstash as a service.

Open
#4,075 8 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

Setup:
I'm on a clean install of CentOS7 minimal, and I've installed logstash 1.5 and elasticsearch1.44 via yum

Problem:
Logstash won't index data from /var/log/mylogs without it being started manually at command line. No errors are present in logstash.err, no data in logstash.log to help, and nothing in ES logs.

I thought this was interesting (saved from console of logstash on manual start):

{:timestamp=>"2015-10-21T08:57:56.694000-0400", :message=>"No sincedb_path set, generating one based on the file path", :sincedb_path=>"/root/.sincedb_8f309eb34476af59efaabf28f6aac73a", :path=>["/var/log/python_apps/_.log", "/var/log/python_apps/_.log.*"], :level=>:info, :file=>"logstash/inputs/file.rb", :line=>"120", :method=>"register"}

But, I can't find .sincedb, on my box, at all (tried various forms, checked all home folders, find, locate, ls -a | less, etc). I'm also told that because logstash may be starting as something other than user logstash, that might be the cause. But, /etc/init.d/logstash:

LS_USER=logstash
LS_GROUP=logstash

And, that I doubt that would explain the console output?

I'm out of ideas why logstash can't init correctly and has to be started manually, instead of as a service "systemctl start elasticsearch.service"

Bug? My fault? Need more docs / data?

Thanks for your time.

(Please give me up to 24 hours to reply. This is for work, I don't have remote, and it's super frustrating trying to reply to a thread that's been closed prematurely.)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.